         (try+
           (case (validate-message broker capsule connection is-association-request)
             :to-be-ignored-during-association
-            ;; TODO(ale): log access (PCP-385); doing nothing for now
-            (do)
+            (log-access :warn (assoc message-data :accessoutcome "IGNORED_DURING_ASSOCIATION"))
             :not-authenticated
             (let [not-authenticated-msg (i18n/trs "Message not authenticated")]
+              (log-access :warn (assoc message-data :accessoutcome "AUTHENTICATION_FAILURE"))
               (if is-association-request
                 ;; send an unsuccessful associate_response and close the WebSocket
                 (process-associate-request! broker capsule connection not-authenticated-msg)
                 (send-error-message message not-authenticated-msg connection)))
             :not-authorized
             (let [not-authorized-msg (i18n/trs "Message not authorized")]
+              (log-access :warn (assoc message-data :accessoutcome "AUTHORIZATION_FAILURE"))
               (if is-association-request
                 ;; send an unsuccessful associate_response and close the WebSocket
                 (process-associate-request! broker capsule connection not-authorized-msg)

              nil)
            :to-be-processed
            (do
              ;; TODO(ale): log access (PCP-385)
              (let [uri (broker-uri broker)
                    capsule (capsule/add-hop capsule uri "accepted")]
                (if (= (:targets message) ["pcp:///server"])

                (send-error-message message not-authorized-msg connection)))
            :expired
            (do
              (log-access :warn (assoc message-data :accessoutcome "EXPIRED"))
              (if is-association-request
                ;; send back the ttl-expired immediately, without queueing
                (let [response (make-ttl_expired-message message)
